Empirical equipment damage models were developed or are under development, partly based on the analysis of past accident data (Salzano et al., 2003; Campedel et al., 2008; Antonioni et al., 2009). The lack of detailed equipment damage models is the main limitation of the methodology and a significant source of uncertainty. Further work in this direction is therefore required. This will also decrease data and model uncertainties inherent in the analysis.

Some natural hazards, for example, a strong earthquake or flood causing a Natech accident are likely to simultaneously down on- and off-site lifelines and utilities required for accident prevention and mitigation. The loss of utilities can either trigger the Natech accident in the first place, or hamper emergency-response actions to mitigate its consequences. Therefore, a worst-case risk-analysis approach seems warranted in which the failure of internal and external safety and mitigation measures is assumed in the QRA scenario-building process.

The flowchart in Fig. 7.3, which was adapted from Antonioni et al. (2007), shows the principal steps in the quantitative analysis of seismic Natech risk. This methodology is also applicable to the analysis of Natech risk due to any other type of natural-event trigger. The starting point in the analysis of seismic Natech risk is the characterization of the natural hazard in terms of severity and frequency at the location of the hazardous installation (Step 1) and the identification of the target equipment (Step 2). Information on the PGA is easily available from measurements or historical records, and PGA is therefore practical for characterizing the severity of the ground motion (Campedel et al., 2008). Probabilistic seismic hazard analysis (PSHA) can be used to estimate the occurrence probability of an earthquake with a given intensity at a specific location. For the analysis of flood Natech risk, information from flood hazard maps prepared by government authorities, or reports and anecdotal information on past inundations could be used to characterize the flood severity in terms of water height, speed, and duration (Krausmann, 2016).

The natural-hazard scenarios on which the risk analysis is to be based are often determined by the regulator which may require protection of a hazardous installation against specific natural-hazard levels (e.g., a 100-year flood or an earthquake with 475 years return period). The operator can decide to voluntarily ramp up safety levels above minimum requirements, and operators that have already been affected, for example, by floods, recommend using worst-case natural-hazard scenarios in the site’s external hazard identification.

The target equipment that poses the greatest safety risk can be identified based on evidence of its involvement in past Natech accidents, determined from chemical- accident database analyses (Sengul, 2005; Krausmann et al., 2011b; Santella et al., 2011) and the criticality in case of LOC. The latter is defined by the equipment’s operating conditions in terms of temperature and pressure and the amount and type of substance it contains. These factors, together with the extent of damage suffered by a piece of equipment due to earthquake loading or impact by another type of natural hazard, also influence the accident scenarios which can develop following a LOC event.

Once the target equipment has been identified, the possible damage caused by a natural hazard has to be associated with it. Detailed earthquake damage models are available for certain types of equipment, for example, storage tanks, from structural-engineering applications. Use of these models is, however, not practicable for assessing the risk to a chemical complex with its many units and structures. Following the approach used in HAZUS (FEMA, 2003), the damage to a piece of equipment can be approximated by defining a limited number of discrete damage states DS (Step 3). These damage states are then used to calculate the expected severity of LOC. Depending on the application, a different number of damage states can be applied. Antonioni et al. (2007) use two damage states, where DS1 indicates limited structural damage with a partial loss of vessel inventory or entire loss in a time interval higher than 10 min, and DS2 indicates extended structural damage with complete loss of inventory in less than 10 min. On the other hand, Salzano et al. (2003) define three damage states with DS1 and DS2 denoting minor and relevant structural damage, respectively, and DS3 corresponding to total structural collapse. In order to describe the severity of release they then associate three so-called risk states with these damage states (minor and relevant release, loss of complete inventory). Other damage and risk states can be defined.

The accident scenario(s) following LOC depend on the substance hazard and the extent of release, which is defined by the magnitude of the LOC (small or big hole) and the storage or operating conditions. For instance, even if the damage severity is the same, releases from pressurized equipment could have very different consequences than discharges from vessels kept at atmospheric pressure. The quantity and conditions of the released substance can be determined using source-term models. Once the LOC severity is known, event trees can be applied to identify the final outcomes of the scenarios of a specific damage mode (e.g., pool fire, jet fire, toxic dispersion, vapor cloud explosion, etc.). Specific event trees, derived from the analysis of past Natech accidents, should be used to consider the dynamics of Natech events (Cozzani et al., 2010; Renni et al., 2010). Although a realistic Natech risk analysis would also require an assessment of the natural-hazard impact on existing protection measures, Antonioni et al. (2007) recommend disregarding prevention and mitigation measures as they would likely be damaged by the earthquake and therefore not be available.

The probability of a target equipment to suffer a specific extent of damage as function of the earthquake severity (e.g., PGA) can be estimated from fragility curves or using so-called probit functions (Finney, 1971; Vílchez et al., 2001), with both approaches being equivalent (Step 4). Although some fragility information for typical chemical storage and processing equipment is available (e.g., Kiremidjian et al., 1985; Seligson et al., 1996; Salzano et al., 2003; Fabbrocino et al., 2005; Di Carluccio et al., 2006), probit functions are more widely used in industrial quantitative risk analysis. The probit variable Pr_DS is a function of the PGA and can be easily converted into the equipment damage probability P_DS for a specific damage state DS (Finney, 1971):

The frequency of the accident scenario associated with specific equipment damage is then calculated by multiplying the frequency of an earthquake of a given PGA value with P_DS. Campedel et al. (2008) provide a list of the probit coefficients k1 and k2 for different types of equipment based on empirical data. The probit coefficients also depend on the existence of implemented safety measures (e.g., anchoring of equipment) and the filling level which determines the criticality of liquid-sloshing effects due to the earthquake forces (Ibrahim, 2005). The lack of detailed equipment damage models linking damage states to probabilities is at present one of the main limitations of the proposed analysis methodology.

The consequences of the final outcomes of an accident scenario can be assessed using conventional consequence models (Step 5). They include not only dispersion, fire, and explosion models, but also effects models including probit functions that allow the calculation of the impact of overpressure, heat radiation, and toxic effects on the population (e.g., van den Bosch and Weterings, 1997; CCPS, 2000). A brief synopsis of consequence-analysis models is provided in Section 7.3.2.1.

For some Natech accidents there is a high likelihood that several chemical process or storage units are damaged simultaneously by the natural hazard and hence more than one accident scenario will occur. This is taken into account in Steps 6–8 where the event combinations are identified, and their frequencies and consequences evaluated. The overall consequences of the combined scenarios can then be derived by summing up the results, for example, human health impact for each single accident scenario. The calculation of the overall frequency of the identified combinations of scenarios is presented in detail in Antonioni et al. (2007). In the last step (9) the risk from the identified accident scenarios is estimated and visualized as individual risk or F–N curves.

Risk analysis can be used in several ways to improve the safety of a hazardous installation. It helps identify system weaknesses, provides input for the setting of risk-reduction priorities, or quantifies the improvement achieved by the implementation of targeted risk-reduction measures for optimizing expenditures. Alternatively, the outcome of risk analysis feeds into the decision-making process by providing risk estimates that can be used for comparison with risk criteria that need to be complied with to fulfill regulatory requirements. This step in the risk-assessment process is also referred to as risk evaluation.

Although the analysis of risk is a rather scientific task, the management of the resulting risk involves a great deal of consultation and negotiation between all stakeholders. This includes decisions on which types of risk and associated risk levels are acceptable or tolerable and which are not. In this context, acceptable and tolerable are not identical. Instead, “tolerable” refers to the willingness of society to tolerate certain risks as long as the benefit outweighs the risks (HSE, 2001). Moreover, in most legal frameworks for chemical-accident prevention proof needs to be given that the risk associated with a hazardous activity is controlled. This includes the identification and implementation of adequate risk-reduction measures.

There are several methods to judge whether a specific risk level is sufficiently low. A cost-benefit analysis expresses the residual risk in terms of monetary value. The term “as low as reasonably practicable (ALARP)” defined in the United Kingdom indicates an approach that avoids risk reduction that would incur grossly disproportionate costs (Cox, 1998). Other possibilities to judge whether a risk is acceptable are expert judgment or prescriptive numerical risk targets or criteria. In addition to the regulatory regime and the political context, the definition of these absolute risk criteria strongly depends on society’s attitude toward hazards.

Practically, there is a general framework that defines three levels of risk as illustrated in Fig. 7.4 (HSE, 2001). In the top zone risk is unacceptable and must be reduced at any cost. Risks falling into the zone at the bottom are considered negligible and usually no further risk-reduction actions are required. The tolerable risk zone would then lie in between these boundary levels. This area is subject to proper risk assessment and the implementation of risk-control measures to achieve risk levels that are as low as practicable.

In the European Union (EU) there are no uniform risk criteria as safety approaches (probabilistic, deterministic) vary across its Member States. Some countries have developed risk-based criteria, defining acceptable levels of risk, while others specify consequence-based criteria which establish maximum permissible levels of overpressure, heat radiation, or toxic concentration. Based on the risk criteria used in selected EU Member States, Trbojevic (2005) suggests a set of common criteria for individual risk. In his proposal the boundary for unacceptable individual risk is set to 10⁻⁵ events per year while negligible risk is 10⁻⁸ per year. The target level for individual risk within the tolerable risk zone should be 10⁻⁶ per year.

The decision about the acceptability of risk must take both individual risk and societal concerns into account. Developing criteria for the risk of multiple fatalities in one accident is, however, difficult and only few countries have defined numerical values which are either prescriptive or used as nonlegal orientation norms. As an example, in the Netherlands the expected frequency of accidents involving more than 10 fatalities must not exceed 10⁻⁵ per year, while for accidents with more than 100 deaths the frequency must not be greater than 10⁻⁷ per year (Duijm, 2009).